Has the ideas machine broken down? - <AUTHOR> http://www.economist.com/news/briefing/21569381-idea-innovation-and-new-technology-have-stopped-driving-growth-getting-increasing <comment><USER2> I assure you, it has not.

Sometimes it's hard to look past TechCrunch and the endless SaaS/CRUD apps, but we're in the middle of a technological revolution right now. Platforms like Kickstarter are driving innovation like never before, pushing forward ideas that would have never seen the light of day otherwise. The new tech coming out of the machine is awe-inspiring.

Even as a tiny, tiny sample of what's happening out there: Google's making self-driving cars, healthcare is advancing by leaps and bounds, and portable electronics have changed the way we live our lives over the course of but 5 years.

Google Glass? Oculus Rift? Leap Motion? MYO? All tech that would simply blow your mind just 10 years ago, but we're practically taking it for granted today. I'm typing this on a thin glass slab, for Christ's sake, this is something out of Star Trek.

If you're struggling to see innovation, you aren't looking hard enough.

<comment><USER3> There is no inovation in health care. We can't grow organs, we are still dying of hearth diease and diabetes.

Doctors know how important exercise is but keep turning out study after study on the subject instead of figuring out how to get the same effects in a pill. They don't even want to cure cancer, prefering ever more expensive treatments.

You talk Star Trek, at this point I would be impressed with a goddamm hypospray. Tech companies have made it possible to get live video from the other side of the planet, it is about time the rest of the sectors step up.

<comment><USER4> _we are still dying of hearth diease and diabetes._ We're dying of everything it's possible to die from. Nevertheless far fewer people are dying of heart disease and diabetes than ever.

 _Doctors know how important exercise is but keep turning out study after study on the subject instead of figuring out how to get the same effects in a pill._ Human biology is not subject to Moore's Law. There will never be a pill which encapsulates the effect of getting some exercise.

 _They don't even want to cure cancer, prefering ever more expensive treatments._ Or maybe cancer is complex and those ever more expensive treatments _are_ as close to a cure as we can come right now, providing the very idea of 'a cure for cancer' isn't a misunderstanding of the nature of the problem.

<comment><USER5> I certainly do get the sense that medical progress has stalled. Perhaps all the "low hanging fruit" has been picked and future progress will be much harder.

As the article mentions antibiotics were both a lot easier to develop and had a much bigger impact than genomic research - at least so far. It sure seems like we have made very little overall progress even on targeted diseases, such as cancer, despite vastly increased spending. Spending on both healthcare and healthcare research have roughly doubled in nominal dollars since 2000 with little overall impact.

I understand that, at least in the US, healthcare is fundamentally broken - results have little connection to costs. But is this enough to be holding back the entire economy? Is tech's impact really just smaller than we think? And are other sectors, especially government activites, also lagging behind and thus dragging down overall performance?

<comment><USER4> _Perhaps all the "low hanging fruit" had been picked and future progress will be much harder._

I think that might have something to do with it. Maybe there's only so far you can go in reducing the cost or complexity of some of the problems medicine has to solve now, or maybe the money in research goes first to the treatments which turn the biggest profit for hospitals?

Also I wonder whether the progress in the tech sector isn't just more visible than progress in medicine. It's a lot easier to see the way the iPod has iterated over a decade than, say, to see the way genetic screening has. Though of course medicine and tech are inextricably linked, maybe it would be better to say 'medical tech' versus 'consumer tech.'

And of course there's the issues of religion and politics. If we could say, clone ready-made human organs for transplant, just handwaving away the 'growing them' part, how long would the technology be held back by public and political squeamishness about the process itself? If it requires something akin to industrial, mass-production of living human tissues and stem cells? Even if it saved a million lives tomorrow, it might take decades to pass into a level of public tolerance that makes it politically acceptable to fund the research.

</comment></comment></comment></comment></comment><comment><USER6> This is actually the reverse effect, I think, disruption blindness. Disruption has become so commonplace that we've started to call it complete even when it's in its early stages (such as the current PC revolution). And we've become used to a rapid pace of massive disruption. So even while we're in the midst of several big transformative changes to the world wrought by technology, we get impatient. Why isn't the entire world being revolutionized EVERY year? Has the pace of development slowed down?

Just calm down and readjust your perspective.

Consider even just the tablet revolution, which has only just started. The low parts count of tablets makes them ideal low cost computers. The long battery life makes them perfect for use in areas without ubiquitous electrical power. And the intuitive touch based interfaces make them perfect for use even by people who aren't literate. Over the next 20-30 years we're going to see a massive acceleration in the diffusion of computing technology into the developing world. Which will have a huge impact on education, communication, economics, and industry. This will be one of the most profound things to happen in the history of humanity, but nobody's paying enough attention because everyone in tech journalism has the IQ and attention span of a gnat.

Meanwhile, over the same time frame increases in computing power are going to be a key element in the rise of fully configurable and fully automated manufacturing, as well as automated long-distance transportation (not just driverless cars), and a strong transition away from mass production as we've known it. All of which will transform the economy and society in ways we can scarcely imagine today. That's not even to mention the rise in space exploration, exploitation, and colonization that is in the midst even as we speak. The world of 2050 will be more futuristic and unfamiliar to the people of 2013 than the fictional futures of Star Trek or Blade Runner.

<comment><USER7> "everyone in tech journalism has the IQ and attention span of a gnat"

I take great offense and strongly object to your unwarranted, unjustified, uninformed, misinformed, just plain wrong insult of good and innocent gnats!!!!

</comment></comment><comment><USER8> As others are saying, there is a lot of innovation going on. However, I propose that the "digital economy" is quite different from anything we are used to.

The productivity gains are not necessarily such that they contribute to growth -- at least, not they way we are used to measure it.

It seems that two of the big effects of the Internet is removing rentiers and middlemen, and lowering costs across the board, the first because, well, _connecting people_ , the second because of multiplicative efficiency increases.

This enables smaller organizations to capture a bigger part of a smaller pie. This is most visible in strictly informational sectors, such as free software, music and publishing, but I don't think it's constrained to that but rather the effect of adding "intelligence". The end game of a company like AirBnB for instance, is to replace (all) hotels, for a fraction of the turnover (but higher profit margin). The same could be true of self driving cars -- we believe it will let us make do with fewer cars, because they are easier to share. Indeed, Google is perhaps the foremost example, incessantly cutting away at the advertising sector (along with related industries), filling the same purpose but better and an order of magnitude cheaper.

This is not growth, but degrowth. The thing is, it is still good and valuable -- it's just that it's not reflected in GDP.

I would say that this has been going on for a few decades, which is why we've seen the rise of the financial sector, which seems, to me, to be a kind of "manufactured growth" -- all of our politics and policies expect, indeed, _demands_ growth in order to work. So when it slows, or rather changes it's nature if you will, we invent fake growth.

In summary, I agree with some of the "pessimists" in the article, but I'm optimistic and hopeful about it. I think we can really live abundant.

<comment><USER9> No, what you have just described is the epitome of _increased productivity_ and therefore increased GDP. In fact, productivity gains are the primary contributor to rising standards of living (higher GDP per capita).

Take self-driving cars. Sure, one might fixate on the fact that car manufacturers will lay off workers and that cab/truck drivers will lose their jobs. But that's a very narrow way of viewing things. If self-driving cars save 20 minutes in each American's day (commute, going out, filling up the tank), we're looking at more than 11,900 human _years_ saved _each day_ , just in the US. This figure doesn't even include the fact that when you are in the car you can do work or read while the car is driving itself. And we haven't even looked at: 1) health benefits from lower air pollution, 2) cheaper and more efficient transport of goods everywhere (lower costs for every type of good), 3) more efficient allocation of real-estate (no parking garages in the middle of the city), and 4) numerous other effects I am probably leaving out.

<comment><USER8> You mention improvements such as lower air pollution. We don't measure that in GDP today. That's kind of my point. If we internalize externalities, then all of the effects I am talking about will also contribute to GDP.

But the way we measure GDP today, it looks like growth is slowing. Indeed, some people, even in this community, feel we are working too many hours for little reason. If we are to make truth of that, and work less with more meaningful things, then that too would decrease GDP. But it would presumably _increase_ well-being.

So what I propose is that we start measuring external costs, add them to the price of goods (so the price better reflects the _real_ cost), and we won't need to fill every space with advertising to keep up consumption.

If you want to read more about these ideas, and others perhaps more radical, I can recommend this book of all my heart: <http://sacred-economics.com/>

_Edit:_ Perhaps the self driving cars were my weakest example. In my mind, the most clear example is that of the free software movement. It's just a massive gain for everybody, built collaboratively. And it took off just as Bill Gates became the world's richest man off software. In a free software economy, that kind of market capture is radically different.

<comment><USER9> Again, things are not as clear as you try to paint them. Better health leads to more productivity and higher GDP because instead of sitting in a hospital, being miserable at home due to disability, or dying prematurely, you are productive, working, and consuming.

Working less _does not necessarily_ drop GDP if it is offset by an increase in productivity. If I work 8 hours with 1 unit of GDP/hour, that is the same as working 4 hours with 2 units of GDP/hour.

Are you saying that free software lowers GDP? That connection is by no means clear cut. Again, we can potentially see productivity gains in terms of lower costs across the board.

I do not (and never did) disagree with you that GDP doesn't cover every metric that ought to be measured (i.e. happiness). I'm correcting you because I think your economic reasoning is flawed for most of your examples. And as it stands, trying to measure "well-being" and quantify that value in terms of prices is so utterly nebulous as a concept as to be nearly impractical. Who would set and enforce the price? How would you even begin to convert happiness to money?

EDIT (reply to below):

First, there is no question that premature death will negatively impact GDP. Furthermore, health problems that don't lead to a hospital stay but lead to general disability will drag down productivity. Furthermore, while in the short term a hospital stay in of itself (lets say, a $100,000 bill for lung cancer) will increase GDP by the bill ($100,000), that money partly comes out of savings that would be spent anyway in the long term. And the ability for someone to create value as a productive worker/consumer is still severely curtailed as a result. And while I'll concede that reducing hospital stays in of itself has a negative effect to GDP, improvements in health end up being net positive for GDP.

As for the larger philosophical question of GDP. Who is "we"? The economy will optimize for itself (higher GDP) because that is how a market economy is set up. And a market economy is not set up to optimize for anything other than growth/money (money representing economic value). As for "people," people, society, and governments routinely already optimize for other things.

<comment><USER8> _Again, things are not as clear as you try to paint them._

I might say the same thing to you. Your miserable person in a hospital might actually count towards GDP, for instance. I'm sure you're familiar with the broken window fallacy, and to me, it still seems to run wild.

Regarding your last paragraph, I think we are getting to the crux of the problem. What is the purpose of optimizing for GDP if it can't encompass what's important? It might not even be correlated. So I propose we change the incentives and optimize for something else than "growth", as it were.

</comment></comment></comment></comment></comment><comment><USER5> This seems to contradict the feeling of great progress in technology over the last few years. Perhaps it is just an illusion that when "software is eating the world" it is actually making the world better. Perhaps it is being negated by lower productivity in the rest of the economy or government. Just seems at odds with my recent experience.

</comment><comment><USER10> We're just spoiled. We want something as disruptive as the internet every year.

<comment><USER11> This. And we want it as an app.

<comment><USER12> For free.

<comment><USER6> Available now.

<comment><USER13> and that works offline

</comment></comment></comment></comment></comment><comment><USER14> Innovation is, and rightly should be, followed by a phase of enjoying its benefits. We are enjoying the fruits of the Internet. Its opened up more options and improved quality of life. My own life has changed drastically since I was introduced to computers twelve years ago. Today I work across continents - not a choice I had in the 90s. My mother can video chat with my nephew and niece everyday. My grandmother can see places across the world in vivid detail without leaving her chair. I can get away by being less knowledgeable. The much reviled 140 characters is a symptom of us enjoying the benefits.

What's the fascination with flying cars? Why is it a poster child of 'innovation'? Innovation is bursty, uncontrolled and usually cross disciplinary. Innovation just happens. For true innovation, pay attention to the Nobel prizes in science, to cutting edge research in science and not just industry. Its also weird to put up known checkpoints like 'flying-cars' to measure innovation.

Does anyone else find it strange that the title is 'idea machine' but content is tangible innovation that reaches the masses?

From the article: >>"Mr Jones says that, from 1985 to 1997 alone, the typical "age at first innovation" rose by about one year." Hmmm .... we are in 2013. Why curate and quote a period from 1985 to 1997??

</comment><comment><USER15> Put the patent trolls to work the fields and the situation will surely improve.

</comment><comment><USER16> It's worth being careful with the provocative title. You should consider that innovation can involve in recycling existing businesses, and the point here is whether they are either generating growth or productivity.

So what this means is that there can be a whole load of innovation occurring, but when it comes down to it, it may not be generating a lot of new growth.

</comment><comment><USER7> I read it a little differently: 1920-1940, just 20 years, including 12 years of The Great Depression, saw just explosive growth in telephones, electric power, electric motors, electric lighting, radio, autos, oil, steamships, chemical engineering, and airplanes with continued growth in railroads and, thus, steel, Great Lakes shipping, and more. Then could go to college and study 'industrial arts' with chemistry, strength of materials, metal working, wood working, printing, etc. with excitement much like studying computer science in college today. My explanation: Small gumment, meager regulation, big bucks left over from the Gay 90s available for investment.

Then 1940-1970 the US DoD kept giving high technology many really big kicks in the back side to move much faster each year. That's what built Silicon Valley, much of Boston, several labs around the country, and many labs around DC.

But, the war in Viet Nam and the subsequent mess of the inflated economy, e.g., the 22% prime rate and the S&L crisis, and the oil shock of 1973-4 slowed things down through at least 1980.

But in 1980, IBM retreated from their grand 'future systems' direction and did another turn on the 370 architecture and started selling 370s again. They were shipping from their plant in Kingston, NY. The 18 wheel trucks that came to pick up the boxes got in a queue starting a the plant and continued out of Kingston and onto the NY State Thruway and formed a queue there. There was a blip in the GDP. So, things were starting to grow again.

By 1990, IBM was starting to hurt; microprocessors were taking a big toll on IBM's revenue. In three years near 1994, IBM lost $16 billion and went from 407,000 employees down to 209,000 and cleared out rush hour traffic jams in several counties north of NYC.

Since then we've had the dot-com bubble, 9/11, two wars of 10 years each, the housing bubble and The Great Recession, the end of the Cold War, the end of much of the Space Race, and, thus, no longer big Federal bucks for 'aerospace'. So, some things slowed down.

This should be a time of explosive growth, especially exploiting the price/performance of current computing and optical fiber along with the infrastructure software. To do what? Sure, to automate as much as possible of everything there is to do -- computers managed by computers ... managed by computers several levels deep managed by humans.

But there is a big financing problem: The big, old companies don't like to innovate, are not being pushed by DoD and NASA, and don't see the big profits that IBM long did. So, innovation is up to small companies. Alas, the way the financing works, really there is essentially no funding for the research and early development anything like what gave us everything from the electric light bulb through the electric typewriter, the nuclear power reactors, the Xerox machine, System 360, the SR-71, Multics, DEC VAX, AT&T Unix, and more.

So, now the IT R&D is from 1-3 guys funded by personal checkbooks. The 'professional' money doesn't want to get involved until all the R&D is done, the product has launched, and there is significant 'traction' growing rapidly. That's a long way from, as I recall, Rockefeller writing checks to get Edison and/or GE going so that we could have electric lighting instead of gas lighting. And if Rockefeller asked Edison how the bulb was going, Edison could only say that he knew 1000 things that wouldn't work.

And the ability to raise money on the stock market is much less good: 100 years or so ago, could form a company on Monday, print stock on Tuesday, sell it to the public on Wednesday, and then by Friday be building the new steamship, railroad, hotel, coal mine, or whatever.

Currently Apple, Google, Cisco, Microsoft and more are sitting big piles of cash and _should_ be able to fund a next big thing like Rockefeller funded electric lighting.

</comment><comment><USER17> No

<comment><USER18> [https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)

</comment></comment><comment><USER19> Everything's Amazing and Nobody's Happy:

<http://vimeo.com/50652818>

</comment><comment><USER20> The Economist, is the maintainer of the current world order, reassures us again and again then all is fine, or getting better.</comment>


Headless Chrome tips after running 5M sessions a week - <AUTHOR> https://codeburst.io/observations-running-more-than-5-million-headless-sessions-a-week-de346c5758fc <comment><AUTHOR> This post was in response to another (last year) post we did last year: [https://docs.browserless.io/blog/2018/06/04/puppeteer- best-p...](https://docs.browserless.io/blog/2018/06/04/puppeteer-best- practices.html). Many of those things still applied, but we've picked up on a few new tricks since then.</comment>


The most downvoted comment in Reddit's history - <AUTHOR> https://www.reddit.com/r/StarWarsBattlefront/comments/7cff0b/seriously_i_paid_80_to_have_vader_locked/dppum98/ <comment><USER2> I'm continually fascinated by the gaming community's relationship with EA.

It's like, "Fool me once, shame on me. Fool me 37 times. . . ahh, what the hey, let's throw another 60 quid in this hole. I'm sure this time it'll be different."

<comment><USER3> Exactly the same with me. I never buy games at launch and I tend to stay away from F2P games entirely. There's way too many games coming out compared to the free time I have available to play them, so I've accepted that I'm never going to play the vast majority of releases. Others need to come to that same realization -- it's perfectly fine to skip a game if the company's practices suck.

As for what I have been playing, I'm really putting a lot of time into Factorio at the moment. It's an indie game that costs $20 for the entire experience and is an amazing value (I'm at hour 70 with no sign of slowing down yet).

<comment><USER4> On Factorio and those kinda game:

To me, Factorio is _very_ basically just simplified Eagle with monsters (Eagle is PCB designer software). You have underground belts (vias), smelters (ICs), inserters (Caps, resistors, 2 lead parts). Then you throw some monsters in there to give some random fuzz on the designs and make things a bit more 'spicy'.

Mincraft is much the same, it's a _very_ basic Solidworks. You can extrude and loft with the voxels, put in some basic digital electronics (redstone), some basic fluids (water/lava), and make simple machines (look at mob-grinders). Throw in some randomness with the creepers and other mobs to make things spicy.

Kerbal is also the same. It's a basic flight simulator. You can mess with staging, centers of mass, and centers of thrust. You can do simple ballistic and orbital mechanics. Then you throw in the wonkiness of the physics simulator and the fan-named 'Kraken' and you have the randomness of monsters (I think they could have done better in this regard)

A lot of these 'indie' sleeper hits seems to be like that: Take some industrial design software, make it so basic a 7 year old can use it, throw in monsters to mess up the designs and to shoot/stab.

Other software that could be used for this process is Z-max (optics design software), some kinda Wall-Street software that's not just excel, maybe some urban planning but better/more random than SimCity/CitiesSkylines, other stuff.

Any ideas?

EDIT: Here is a wiki page of possible avenues: [https://en.wikipedia.org/wiki/Category:Computer- aided_engine...](https://en.wikipedia.org/wiki/Category:Computer- aided_engineering_software)

<comment><USER3> So I've played all the ones that you've mentioned and loved them (especially Kerbal Space Program), but I'd like to point out that they're fun to play because they're _games_ , whereas similar industrial software applications are not games. This is a very meaningful distinction because the addition of game mechanics makes them fun to play around with.

I also don't think the connections are quite so close as you make them out to be. Factorio is at its heart a _survival_ game -- you can't just dismiss the enemies as added "spice", as they are an integral part of the challenge. The advanced factory automation becomes necessary to build up your tech level high enough to take on the higher level monsters that come at you later in the game.

<comment><USER4> I mean, I really like messing about with SW in my free time; the X-Wing is coming along, but I don't really have the ram.

I get that they are games at the end of the day, but many of the elements/mechanics seem to be from 'real' software (in this category of game). It's not a criticism, it's just an observation.

For more on how to go into video game theory, PennyArcade's XtraCredits series is pretty binge-able: [https://www.youtube.com/channel/UCCODtTcd5M1JavPCOr_Uydg](https://www.youtube.com/channel/UCCODtTcd5M1JavPCOr_Uydg)

</comment></comment></comment></comment></comment><comment><USER5> Wow that's some incredible brigading. One of the most upvoted comments (it might be the most upvoted one, don't know) is at a mere 98.6K: [https://www.reddit.com/r/IAmA/comments/5h7gq8/i_was_goofy_at...](https://www.reddit.com/r/IAmA/comments/5h7gq8/i_was_goofy_at_walt_disney_world_for_over_20/day38fu/)

The most upvoted post is 283K: [https://www.reddit.com/r/funny/comments/5gn8ru/guardians_of_...](https://www.reddit.com/r/funny/comments/5gn8ru/guardians_of_the_front_page/)

Considering how upvoted-items get more and more visible, and thus more and more upvotes, it's a huge achievement for a downvoted comment to have that much engagement.

edit: via r/subredditdrama, the most downvoted comments noted so far:

[https://www.reddit.com/r/ListOfComments/wiki/downvoted](https://www.reddit.com/r/ListOfComments/wiki/downvoted)

[https://www.reddit.com/r/SubredditDrama/comments/7cicb7/user...](https://www.reddit.com/r/SubredditDrama/comments/7cicb7/users_turn_to_the_salty_side_in/)

<comment><USER6> > Wow that's some incredible brigading.

Is it really brigading? The entire gaming community hates those practices. Nobody is manipulating people to downvote this comment. It's genuine hate and digust. Paying the price of a game to unlock one single character is a joke.

EA's reply is also very bad. "The intent is to provide players with a sense of pride and accomplishment for unlocking different heroes."

I fail to see how paying $80 gives players a sense of pride and accomplishment.

<comment><USER5> I mean "brigading" in the technical sense of people passing around the link and getting more people to pile on than would organically occur, not necessarily the astroturf connotation. Because for most users, comments under a certain threshold (-50) are hidden (but can be revealed manually). The entire r/Battlefront userbase is just 91K users.

<comment><USER7> I believe the comment received reddit gold specifically to keep it visible.

</comment></comment></comment></comment><comment><USER8> It's weird, the Cluetrain Manifesto is old enough to drive now but companies still don't talk like human beings. I'm not sure what EA's social media group is trying to accomplish by engaging in such a clumsy way.

[http://www.cluetrain.com](http://www.cluetrain.com)

<comment><USER9> I had completely forgotten about this. It makes me sad to read, because it seems like the culture of the tech industry has gone whole-hog on "sterile happytalk that insults the intelligence of markets". Machine learning on the blockchain, anyone?

</comment></comment><comment><USER10> Even though I hate the business model, this is going crazy with people sending death threats to employees. They never hid their intent, the business model for the game has been discussed for a long time.

</comment><comment><USER11> If people hate EA so much, why do they keep buying their games? It's not like Time Warner, with a monopoly you can't avoid.

<comment><USER12> Every copyright is a monopoly on a very specific niche. People arent looking for just some game, they want "that experience they loved from the first game, set in their favorite science fantasy universe" or whatever. They can't get it elsewhere, and thus the publisher can do some pretty abusive things to extract money from the fans. In this case, trying to push people gambling addictions they can exploit for profit.

<comment><USER13> Its sounding like youre trying to start opening a line of debate of:

"If content is part of the national identity or popular outside its initial entertainment function, there should be limitations on the governmental exclusivity(copyright) so that others may use."

<comment><USER14> This is why copyright used to be for a reasonably limited term.

</comment></comment></comment></comment><comment><USER15> Nothing is going to change in the gaming community unless people stop buying these kinds of games. I am on my way to sell COD:WWII as I type this comment as the multiplayer maps are so monotonous and yet they expect me to pay the price of the game again to unlock all the other maps in the next few months (season pass). I'll probably never buy another COD game after this.

<comment><USER16> So, nothing will change then? "Vote with your wallet" doesn't work, and never has.

<comment><USER17> It could work, but it's a lopsided feedback system: EA can't count the number of people who didn't buy their game, they can only count the number of actual purchases. So, voting with your wallet leads to underperforming sales numbers, which they'll rationalize to be based on anything but the insulting ways they try to extract additional money from their players, or the myriad of ways they treat their fan base like idiots.

They learn the wrong lessons, assuming the franchise must be at fault, not the mechanics that make the game loathsome.

</comment></comment></comment><comment><USER18> Only 19 hours old, too.

One thing to keep in mind is that Reddit used to normalize votes until about a year ago or so, such that it was exceedingly rare for a post to get beyond triple digits (both positive and negative). I wonder how many older unpopular comments would have made it into the negative six figures if vote totals had been uncapped sooner.

<comment><USER19> According to the admins, the scores on older posts were recalculated after the scoring was changed.

</comment></comment><comment><USER20> Can anyone explain what this is about, for non-gamers like myself? Am I understanding it right, in that he paid $80 for a game in which he needs to pay even more to get access to the Darth Vader character?

Is there a price list somewhere for what it costs to purchase various in-game things?

<comment><USER21> Good summary of the issue: [https://reddit.com/r/OutOfTheLoop/comments/7cddyo/_/dpqoy26/...](https://reddit.com/r/OutOfTheLoop/comments/7cddyo/_/dpqoy26/?context=1)

<comment><USER22> That has too much jargon to be a good summary to a non-gamer IMO. To wit-

"While some games might offer loot boxes for cosmetic options, Battlefront II is using loot crates as their primary form of progression through the multiplayer content, via Star Cards."

</comment></comment></comment><comment><USER23> Of all the things in humanity to show outrage about, even limiting oneself to considering outrageous topics that made it to reddit posts, this seems very small. I would figure the most downvoted comment in history would show something grotesque.

<comment><USER17> Unbridled greed _is_ pretty grotesque.

<comment><USER23> Of all things you can do to a person, I think mis-pricing something in a video game and a subsequent PR blunder is very small potatoes. Even if we restrict to your phrase "unbridled greed" and exclude more serious topics like physical harm and abuse, there is a _lot_ more of that going on that is worse than this.

</comment></comment></comment><comment><USER24> Looks like everything they are posting is getting down-voted.

[https://www.reddit.com/user/EACommunityTeam](https://www.reddit.com/user/EACommunityTeam)

<comment><USER25> And yet they still have positive karma.

        Most upvoted comment: +318
        Most downvoted comment: -377k

Somehow this results in 7,438 comment karma for the user. What the hell reddit?

edit: and no, the sum of the rest of their comments does not add up anywhere near 377k.

<comment><USER26> Reddit limits how much a single comment can effect your overall karma score. This was done to slow down negative karma trolls.

</comment></comment></comment><comment><USER27> This is why I've stopped buying new games. At 31 years old, I've realized that learning new things is more important than paying to entertain myself.

<comment><USER28> Wait, which is it? When you say "this is why" it implies you stopped because of unbounded greed on the part of large gaming publishers. However, then you explain it as growing out of gaming and a shift in your interests to learning.

Also, in my opinion, learning and entertainment don't have to be mutually exclusive. You sound like an I-don't-watch-TV snob right now, to be honest.

<comment><USER29> Agree. As much as I love HN, I think it suffers from too much snobbery at times...

 _Which is why I 've decided recently (since turning 27 and a half) to transition away from online forums and focus on building pen-pal relationships with fellow hackers through physical mail. Really makes me feel like I'm improving myself_

</comment></comment></comment><comment><USER30> I don't understand the rage here. EA is a busyness, kindly explaining the reasoning behind their product decisions in the open. We should be thankful, not angry.

<comment><USER31> The beatings will continue until morale improves

<comment><USER30> The "me" beating goal is to turn me against EA? I'm way past that point, so the effort is wasted:) I just don't understand how people expect EA to do anything other than maximizing the profits.

<comment><USER32> If a scorpion stings me, I can still be upset about it, despite the scorpion's nature.

</comment></comment></comment></comment><comment><USER33> I left this comment in the previous edition of this post, reproducing here for some context around the "why":

There was another post on Reddit which "did the math" a few days ago: unlocking a hero would take around 40 hours of play, modulo a few challenges and other purchases. There was concern about loot boxes and micro transactions affecting gameplay; I feel it's safe to say those concerns were justified.

<comment><USER34> ... at which point a person can calculate their 40 hours of play * what the time is worth to them, and decide if $80 to just buy the thing is worth it.

<comment><USER35> It's 40 hours after you buy the game ($80).

<comment><USER33> Indeed. Plus, that's 40 hours per hero, not including improvements and gear for the base classes.

</comment></comment></comment></comment><comment><USER36> I wonder if EA will need to get a new user account.

<comment><USER37> I don't know what reddit gold does but could they have given themselves those 12 to counteract the downvotes?

<comment><USER38> EA just posted the most downvoted comment in history of the universe, by orders of magnitude.

[https://www.reddit.com/r/StarWarsBattlefront/comments/7cff0b...](https://www.reddit.com/r/StarWarsBattlefront/comments/7cff0b/seriously_i_paid_80_to_have_vader_locked/dppum98/)

People are actually "hate guilding": paying real money for reddit gold in order to send "fuck you" messages to EA that they can't ignore or mute in a locked thread.

We may be witnessing the birth of a new business model.

EACommunityTeam -652k points 1 day ago [gold star] x67

The intent is to provide players with a sense of pride and accomplishment for unlocking different heroes.

As for cost, we selected initial values based upon data from the Open Beta and other adjustments made to milestone rewards before launch. Among other things, we're looking at average per-player credit earn rates on a daily basis, and we'll be making constant adjustments to ensure that players have challenges that are compelling, rewarding, and of course attainable via gameplay.

We appreciate the candid feedback, and the passion the community has put forth around the current topics here on Reddit, our forums and across numerous social media outlets.

Our team will continue to make changes and monitor community feedback and update everyone as soon and as often as we can.

</comment></comment></comment><comment><USER12> Of course it would be an informative comment that pepole don't like.

<comment><USER39> It's only informative if you take what they said at face value.

</comment></comment><comment><USER40> Ahah, not surprised. That game felt like a beta when it was released, I could not comprehend how they could release something like this. I only started getting back into gaming recently, and to my surprise, the issue of launching broken games seems to be industry practice. Battlefield 1 had so many issues, the new CoD:WW2 has so many issues. I stopped gaming a few years ago (last game was CoD:2), and I am shocked that the community endures this... but what is the alternative? Stop gaming?

<comment><USER41> Battlefront 2 (the new one) isn't released until the 17.

<comment><USER40> I thought they had changed Battlefront 1.

</comment></comment></comment><comment><USER42> Previous discussion here: [https://news.ycombinator.com/item?id=15685405](https://news.ycombinator.com/item?id=15685405)

</comment><comment><USER43> Apparently the huge response had some impact as EA is now dropping the price of some of these characters.

[http://m.ign.com/articles/2017/11/13/ea-to-reduce-star- wars-...](http://m.ign.com/articles/2017/11/13/ea-to-reduce-star-wars- battlefront-2-hero-costs-by-75-percent)

</comment><comment><USER44> Wow, modern gaming is serious business. I wish we devoted this much energy into more, ahem, important things. I'm not sure even movies, books, TV series or other kinds of entertainment would produce such a reaction from people.

</comment><comment><USER45> [https://news.ycombinator.com/item?id=15685405](https://news.ycombinator.com/item?id=15685405)

Was already posted, dunno why double the news!

</comment><comment><USER38> Rumor has it that The Sims 5 will come with only pay toilets, and require an in-app purchase to kill a character.

</comment><comment><USER46> now I downvoted too

</comment><comment><USER47> The most brigaded comment in Reddit's history

FTFY

</comment><comment><USER48> I really want [thing] but cannot afford [thing] at the current price point. Rage! Kick! Scream!

Doesn't this sentiment have to be nearly as old as markets themselves? What makes you more angry, the fact that you cannot get the thing you want? Or the harsh realization that there is a class of people who can afford it, and you are not in that class?

Pricing is science, with a little art thrown in. EA is a publicly traded company whose stock has climbed from $12 to $120 in the last five years. Their imperative is to maximize shareholder value, not appease gamers.

The grown up thing to do is to focus on the things that you enjoy + can afford.

<comment><USER34> People, perhaps, get upset about this sort of thing because game content isn't "real," in the sense that an employee could spend mere seconds (assuming a script was already cooked for them to do it) to give this art asset to players for free. The $80 pricepoint (or 40 hours of game interaction) seems a very artificial thing. It doesn't take $80 worth of work to produce and distribute the Vader art asset, so why should one be compelled to pay $80 for it?

... but this is a misunderstanding of the nature of digital content and monopoly. The old rules of supply and demand still apply---even if satisfying demand is relatively trivial after the archetype has been created---when one party has a monopoly on supply, as EA does here. And when the archetype still takes several dozens or hundreds of person-hours to fabricate, there is still cost to EA to be offset. But even if there weren't cost to EA to offset: they have a monopoly on the product, they can charge what they will, the amount of markup they can generate is immaterial.</comment></comment>


Facebook's Sheryl Sandberg: 'We Understand' Concerns About Big Tech Companies - <AUTHOR> https://www.wsj.com/articles/facebooks-sheryl-sandberg-we-understand-concerns-about-big-tech-companies-11560953840 <comment><USER2> Someone should write a Facebook Executive Official Statement generator

We understand

We apologize

We listen

But in the end we won't do anything about any of it and you're stuck with us anyway</comment>


A React Native Component Which Beautifies Your TextInputs - <AUTHOR> https://github.com/KumarAbhirup/iconic-input <comment><AUTHOR> Be sure you let me know if you like it :-)</comment>


Verizon degrades text & images for iphone - <AUTHOR> http://moconews.net/article/419-verizon-offers-unlimited-iphone-data-but-may-throttle-its-heaviest-user/

<comment><USER2> The scariest part about this is that Verizon is modifying data in transit. Who knows what else they might be doing to it.</comment>


Horde backdoored - <AUTHOR> http://dev.horde.org/h/jonah/stories/view.php?channel_id=1&id=155 <comment><USER2> I've always been very trusting of open source software. I've often thought "surely someone else has looked through this source code" and just assumed that malicious code never hits stable releases. The same goes for "verified" binaries, packages, etc... apparently that is not always the case.

What are the possibilities that such code could make its way into some piece of extremely popular public facing software, say Apache? How many cleverly hidden "bugs" already exist that open us up to complete pwnage for the clever bastard behind them?

Just think about the havoc someone could do with a few popular but nasty PyPi or RubyGem packages...

<comment><USER3> Wasn't there a serious backdoor situation with some Linux distros (Ubuntu?) last year? Some guy came out detailing a 10 year contract of silence or something...

<comment><USER4> You mean the OpenBSD IPSec backdoor controversy? Nothing found AFAIK.

<comment><USER5> HN discussion at the time: <http://news.ycombinator.com/item?id=2029175>

</comment></comment></comment></comment><comment><USER6> The comments on this page immediately reminded me of Ken Thompson's point: "You can't trust code that you did not totally create yourself."

He wrote this right after demonstrating how to create, step-by-step, an undetectable trojan horse in the C compiler. Here are the steps for creating such a trojan horse:

<http://cm.bell-labs.com/who/ken/trust.html>

[ Also see <http://news.ycombinator.com/item?id=2642486> ]

<comment><USER7> You can't totally trust your own code, either. Look at all the buffer overrun vulnerabilities that have been found over the years.

</comment></comment><comment><USER8> So several Horde releases were trojaned for three months? That's pretty terrible. Good on them for coming clean.

What's the best way for open source projects to make it easy for their customers to get verified downloads? A lot of packages post MD5 checksums but no one tests them when downloading manually, do they? Automated signature checking on Debian packages seem to work better in practice; homebrew also verifies download checksums automatically.

<comment><USER9> Checksums provide no security.

Idea: protocol- and package-format-independent verification of packages, with trust rooted in DNSSEC of the ultimate source domain using DANE.

<comment><USER10> That's not entirely true. Since i found how to poison my ISP's PeerApp "invisible" cache servers i started to check MD5 when downloading manually. It does cache big files but not small ones. Here is the link for technical details if you are interested. [http://godlessmechanics.blogspot.com/2011/12/tale-of- sneaky-...](http://godlessmechanics.blogspot.com/2011/12/tale-of-sneaky- proxy.html)

</comment></comment></comment><comment><USER11> Horde 4 is not affected. If you're running it, you're fine.

The affected releases are:

\- Horde 3.3.12 downloaded between November 15 and February 7

\- Horde Groupware 1.2.10 downloaded between November 9 and February 7

\- Horde Groupware Webmail Edition 1.2.10 downloaded between November 2 and February 7

</comment><comment><USER12> Well, shit. So much for host-it-yourself services being more secure. Which dogma do I trust now?

</comment><comment><USER13> Check with: grep -r "\$m\\[1\\](\$m\\[2\\])" /path/to/horde

</comment><comment><USER14> kernel.org, vsftpd, unrealircd, who will fall next?

</comment><comment><USER15> it's 2012: stop using horde and install roundcube !

<comment><USER16> Have you tried Horde 4? It is much better than version 3 and is not affected by this issue.

<comment><USER17> Tried? Yes. Failed? Miserably.

I've happily used Horde for well over 5 years. I was really _really_ looking forward to Horde4. Once it came out, I immediately tried it. Tried to install it, that is. I failed. The lack of clear documentation combined with the dark magic of php-pear kept me from migrating. And even when I did get it installed I was unable to comprehend the UI. It completely changes depending on what 'application' you're using. There is no consistency.

E.g.: The calendar in Horde4. The interface completely changes into nothing you've ever experienced. It's unrecognisable from the rest of Horde4.

I migrated to RoundCube + Plugins for calendar (caldav+davical) and addressbooks (carddav + davical) and have been a happy, android syncing camper ever since.

<comment><USER16> php-pear dark magic is nothing compared to installing the framework libraries from git! The pear.horde.org instructions fail to mention that you must install horde/Horde_Role before any of the applications.

The UI is currently undergoing a rewrite, but the default interface can be forced into the traditional view in the Horde configuration.

</comment></comment></comment></comment><comment><USER18> "Horde backdoored" - Hey, that rhymes!</comment>


RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis - <AUTHOR> http://www.cs.tau.ac.il/~tromer/acoustic/ <comment><USER2> The single coolest thing in the paper (other than Shamir's name): "On many laptops (e.g., most Lenovo ThinkPad models), the chassis potential can be easily reached by a human hand, through metal connectors and conductive coating on metal surfaces. Thus, an attacker can measure the chassis potential by merely touching the laptop chassis with his hand. Surreptitiously, the attacker can simultaneously measure his own body potential relative to the room's ground potential, e.g., by having a concealed differential probe touching both his body and some nearby conductive grounded surface in the room. Perhaps surprisingly, even this circuitous measurement offers sufficient signal-to-noise ratio for the key extraction attack."

<comment><USER3> I wonder whether this is specific to laptops (running from battery or otherwise not grounded) or if it also works with properly grounded desktop computers.

My HP notebook from ~2000 had measurable (although very high impedance) 110V AC between exposed metal parts and PE in wall outlet when connected to charger. Modern thinkpads (and probably all non-Apple laptops sold in Europe) does not seem to have this problem as ground is connected through in charger, not only AC coupled to both hot and neutral.

<comment><USER4> Macbooks can be grounded, too. The round metal thing that's holding the plug in place also serves as a connection for ground. It is moot if you're using the small plug which doesn't have ground but if you connect the cable instead of the plug, or use a UK plug, the computer is properly grounded.

</comment></comment></comment><comment><USER5> Playing loud music when encrypting/decrypting/typing in your password will defend against acoustic attacks, right?

This other type of attack, however, isn't so easily guarded against:

 _Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables._

This serves as a reminder that it's pretty much impossible to defend against an attacker that has physical access to your box.

<comment><USER6> _Playing loud music when encrypting /decrypting/typing in your password will defend against acoustic attacks, right?_

I recommend "Wrecking Ball" by Miley Cyrus. The strength of the attacker's cryptanalysis will be moot because no one will go near you.

<comment><USER7> or... it may increase people's interest in you, you know, for national security.

<comment><USER6> Well, by Bradley Manning's account, he listened to Lady Gaga while leaking classified military documents, so maybe hit pop songs are not as innocent as they seem. :)

</comment></comment></comment></comment><comment><USER8> Important stuff:

> Q9 How vulnerable is GnuPG now? We have disclosed our attack to GnuPG > developers under CVE-2013-4576, suggested suitable countermeasures, and > worked with the developers to test them. New versions of GnuPG 1.x and of > libgcrypt (which underlies GnuPG 2.x), containing these countermeasures and > resisting our current key-extraction attack, were released concurrently with > the first public posting of these results. Some of the effects we found > (including RSA key distinguishability) remain present.

</comment><comment><USER9> This is really impressive work. After skimming through the detailed paper it looks as if they are not picking up sound emitted from the CPU itself, but from the switching power supply circuit.

The frequency variation is caused by load differences. So they are in fact doing an indirect power analysis. A switching power supply will always change frequency as a reaction to variations in supply current, this is inherent to its design. I also believe that it will be very difficult to "muffle" all the inductors and capacitors as they are subjected to very high pulse loads. Magnetics will always find a way to emit sound...

It's interesting to note that the biggest difference seems to be between register and memory instructions. This seems reasonable as memory instruction may, in the worst case, require powering the external bus, which is very power hungry. This will only get worse in future CPUs, as more and more clock gating is introduced.

So, I guess some countermeasures could be:

\- If the CPU supports SMT or HT, load the other cores with a thread accessing random memory positions.

\- Optimize the RSA code so that it's memory access and runtime pattern does not depend on the key or clean text.

\- Try to localize the RSA code as much as possible to reduce memory accesses. If memory access is required, do it all at once, for example by swapping entire cache pages.

Some of these are highly CPU dependent.

</comment><comment><USER10> This is the patch they used to mitigate it afaict.

[http://git.gnupg.org/cgi- bin/gitweb.cgi?p=libgcrypt.git;a=co...](http://git.gnupg.org/cgi- bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=dec048b2ec79271a2f4405be5b87b1e768b3f1a9)

</comment><comment><USER11> Nobody mentioned TEMPEST yet in this comment thread. It's old (60s) but very interesting stuff. [https://en.wikipedia.org/wiki/Tempest_%28codename%29](https://en.wikipedia.org/wiki/Tempest_%28codename%29) It includes acoustical leaks as one side channel. Also see: [http://www.nsa.gov/public_info/_files/cryptologic_spectrum/t...](http://www.nsa.gov/public_info/_files/cryptologic_spectrum/tempest.pdf) It's cool that they were able to demonstrate it that well.

<comment><USER12> Came in here to make this exact comment -- the amount of things looked into as ways to leak secrets was insane, even going as far as detecting screen radiation IIRC.

<comment><USER13> Check out this researcher's papers: [http://www.cl.cam.ac.uk/~mgk25/](http://www.cl.cam.ac.uk/~mgk25/) esp. "Optical Time-Domain Eavesdropping Risks of CRT Displays"

</comment></comment></comment><comment><USER14> _Using multiple cores turns out to help the attack (by shifting down the signal frequencies)._

I don't understand how this would be, maybe because I don't understand what they mean by "using multiple cores."

You'd think that running a decoy thread on another core would mask things pretty effectively.

<comment><USER15> Disclaimer: I never worked with the sound side-channel, so maybe what I'm going to say is not entirely true, but the general idea should be right.

Actually I think the job of the other core would be more difficult than just doing random noises to _mask_ the noise from the actual secret computation. Simply doing random computations (and thus, random noises) of the other core is not effective since random noise would "easily" be canceled using statistical tools (for instance, looking at the variance of the data instead of looking at it directly will already reduce some type of noises).

What would be more effective would be to _balance_ the noise for instance, maybe running the same computation with opposite data would balance it more effectively. To picture what I'm saying better, here is a _completely fanciful_ example (just to provide an idea). Imagine that during the RSA exponentiation (where the private key is exposed), the operation that is done when the bit of the secret key is 1 makes the sound "s_s_" and when it is 0 the sound is "_p_k". If you do the the same computation as the secret one on the other core exactly at the same time, but with the opposite secret key, then whatever the key is the attacker will always ear "spsk" at each clock cycle. And that will be harder to attack than random noises (but is also more difficult to achieve, of course).

That said, I don't know why the use of multiple cores would help the attack (but I didn't read the paper, just a few sample of the linked web page).

</comment></comment><comment><USER16> What's interesting are old school spy acounstic methods. [http://en.wikipedia.org/wiki/Laser_microphone](http://en.wikipedia.org/wiki/Laser_microphone) <\-- great primer. This played out in micro surface vibration in a cup of coffee in the movie Eagle Eye (terrible movie btw). Either way, kind of a neat way to spy on embassy windows from a far w/o even having to be in the room. A little off topic was the KGB's bugging a government office with passive radio transmission - virtually undetectable [http://en.wikipedia.org/wiki/Thing_(listening_device)](http://en.wikipedia.org/wiki/Thing_\(listening_device\)) This stuff is so damn cool. :)

</comment><comment><USER17> Just to be clear, I believe this is from 2004.

<comment><AUTHOR> This was originally presented was in 2004, but since then has been refined in a number of ways. The detailed paper that includes the full key extraction attack was only released today, coinciding with the GnuPG security update that mitigates against the attack.

<comment><USER18> It took 9 years to fix GPG?

<comment><USER19> GnuPG 2.x wasn't vulnerable, just the old 1.x: [http://lists.gnupg.org/pipermail/gnupg- announce/2013q4/00033...](http://lists.gnupg.org/pipermail/gnupg- announce/2013q4/000337.html) "GnuPG 1.4.16 avoids this attack by employing RSA blinding during decryption. GnuPG 2.x and current Gpg4win versions make use of Libgcrypt which employs RSA blinding anyway and are thus not vulnerable."

<comment><USER20> RSA blinding seems to protect against timing attacks, how does RSA blinding protect against this acoustic attack?

</comment></comment></comment></comment></comment><comment><USER21> Random comment: Could similar attacks be used to extract the private key for Bitcoin accounts?

<comment><USER22> These attacks are specifically for the operations involved in repeated use of long-term RSA keys, and Bitcoin uses ECDSA keys a relatively small number of times, so the attacks would be materially different.

However, I would not bet against the fact that your machine outputs "compromising emanations" (be they acoustic or RF or otherwise) leaking _some_ information about your bitcoin keys.

There is less opportunity to execute such an attack in the bitcoin universe, though, as bitcoin-qt doesn't reuse keys that much. (When you send a payment, the "change" difference is sent to a new key.)

It's something to think about, but the attack surface is a lot smaller. Perhaps there's something specific in the ECDSA algorithm that may make it easier or harder? I don't have the requisite mathematical understanding of elliptic curves to know how they're executed in-CPU.

</comment></comment><comment><USER23> I've read the linked document, but this feels like magic to me. Is the general idea something like : i can hear the CPU is doing 10 additions, then 20 substractions, twenty times in a row, so i can tell by knowing the algorithm used that the CPU is computing a public key and that it must be between 1 billion and 1.5 billion ?

<comment><USER24> No, more like the CPU will, in some cases, need to do more work if the key is X and less work if the key is Y, and we specially craft our plain-text to have many X/Y pairs as possible, so that we can hear the capacitors working harder when decrypting.

</comment></comment><comment><USER25> Without taking party, I am deeply impressed at an increasing rate and with honest respect to the ingenuity of the research that's coming from Tel Aviv, Israel and from Switzerland. There is no other country except the USA which makes such leaps in technological progress. That's my honest image of the research. I'm personally reading many of their publications and from various other journals too.

</comment><comment><USER26> If three academic types can come up with this, just imagine what the NSA or other foreign intelligence groups can find with a budget like they have.

Interesting for sure.

</comment><comment><USER27> If that attack is available for us to know, I wonder what can possibly be happening inside NSA?

I even wonder how these big guys/heroes like Julian and Snowden feel when they find out about it. I mean, maybe they just don't care about the stuff they have being accessed without their consent, it is supposed to be released anyways, but what about their conversations that are supposed to be highly confidential?

</comment><comment><USER28> When I started reading I thought this must be a joke. As a dev with what I like to think is a solid understanding of computer hardware I don't often think of new tech as spooky/sci-fi-esque, but this is so unbelievably cool. I have no words.

</comment><comment><USER11> Fixed GnuPG 1.4.16 version released: [http://lists.gnupg.org/pipermail/gnupg- announce/2013q4/00033...](http://lists.gnupg.org/pipermail/gnupg- announce/2013q4/000337.html)

</comment><comment><USER29> A good enough solution might be using appliances designed with older cpus with little to no power management features but it is only practical for high stakes stuff like military comms I guess.

</comment><comment><USER30> Some motherboards have programmable/adjustable VRMs. I wonder if the settings can be changed to mitigate the threat.

</comment><comment><USER13> I remember being able to hear a program run on an HP 32S (RPN) by placing it up to my ear, so this isn't surprising.

</comment><comment><USER31> What about computers located in the datacenter, next to other people's computers?

</comment><comment><USER32> I really want to call B.S. on most of their claims, but I withhold any judgement until there is a live demo performed. Have they announced a timetable for a live demo?

<comment><USER15> Just go to any conference about cryptosystems' implementation security (like CHES), or to any exhibition on this topic (like CARTES) and you will be bluffed by demos of side-channel attacks, which are very real.

</comment></comment><comment><USER33> This sounds like BS, smells like BS.. But then again he is Shamir.. Still I think it is BS

</comment><comment><USER34> This is a really well written fake.

Use some common sense.

Are you only doing one thing on your computer? No.

Does your Memory vibrate when the data is stored? No.

Can data be transferred via acoustics over a 2 conductor 16 gauge wire at the speeds memory is accessed or is sent to the CPU? No.

Think of something you have heard "hum". Is the noise pattern of your Amp and another the same if the "hum is anything other than 60hz? No. Because manufacturing tolerances are not such that the flaws are the same.

This is really great FUD. Likely designed to get People to think that they are constantly at risk, and have the CIA and FBI spend billions buying acoustic shields for their computers.

If this is real. And does work, fine, just run a background task that puts multiple random RSA's through the paces in alternate threads so the extraction can't take place because of garbled data.

EDIT: Apparently I forgot that HackerNews You get downvoted if you present common sense in face of a fallacy that those with limited understanding want to hold true, as seen by the mass of links to wikipedia made by those with out the foggiest about audio, capacitance, RSA, or Electrical engineering.

-Brandon Wirtz SMPTE

<comment><USER35> This is a very weak dismissal. Have you read the actual details they claim?

Side-channel attacks (like power analysis) in the presence of other activity are well established.

Electrical signals causing audible frequency output are also well established. Look up the piezoelectric effect[1], or magneto/electrostiction[2][3]. The demand for miniaturisation of everything means even at low voltages, there are quite substantial electric fields across small distances, which are enough to flex the material audibly.

On the magnetostriction side, the flyback transformer in old CRT televisions is a perfect example. Myself and many people have been able to tell whether the TV was powered up (even if totally muted) from outside the room (and yes, double-blind tested repeatedly).

What does wire gauge have to do with anything?

On the practicality/data rate issue, a nice quote from the very intro of their paper states:

> In a nutshell, the key extraction attack relies on crafting chosen > ciphertexts that cause numerical cancellations deep inside GnuPG's modular > exponentiation algorithm. This causes the special value zero to appear > frequently in the innermost loop of the algorithm, where it affects control > flow. _A single iteration of that loop is much too fast for direct acoustic > observation, but the effect is repeated and amplified over many thousands of > iterations, resulting in a gross leakage effect that is discernible in the > acoustic spectrum over hundreds of milliseconds._

(emphasis mine)

It seems that the main focus of their work is to fingerprint the crypto and identify that a particular key was used (but not necessarily what the key _is_ ), which is a much easier problem than the one they talk about here, which requires specially crafted input over a substantial period of time.

Your solution might work, or it might just lower the SnR of the signal and require filtering larger quantities of data to extract the desired signal again.

The road to crypto-hell is paved with people who thought that they could use their "common sense" to reason intuitively about their problem. But to paraphrase Feynman, Mother Nature is not swayed by persuasive arguments.

[1] [https://en.wikipedia.org/wiki/Piezoelectricity](https://en.wikipedia.org/wiki/Piezoelectricity)

[2] [https://en.wikipedia.org/wiki/Magnetostriction](https://en.wikipedia.org/wiki/Magnetostriction)

[3] [https://en.wikipedia.org/wiki/Electrostriction](https://en.wikipedia.org/wiki/Electrostriction)

<comment><USER36> I am one of those people who can hear a CRT television from a room or two over. Comes across as a very distinctive high pitched squeal. I always assumed that other people couldn't hear it simply because it was too high.

It actually seemed worse when my LCD TV broke last year and I pulled out my old CRT to watch a movie in the meantime. I don't know if I had just grown unaccustomed to hearing it or what, but it was annoying me even through the sounds of the movie.

<comment><USER15> Whoa, I had to reread your comment twice to understand it properly. In the context of RSA, and particularly speaking about its weaknesses, for me "CRT" automatically stands for "Chinese Remainder Theorem"… :-D.

If that interest someone, look for the BellCoRe attack on CRT-RSA [1,2]. I'm also working on the countermeasure as part of my PhD [3,4], and it's quite some fun!

[1] [http://cryptome.org/jya/smart.pdf](http://cryptome.org/jya/smart.pdf)

[2] [http://eprint.iacr.org/2012/553](http://eprint.iacr.org/2012/553)

[3] [http://eprint.iacr.org/2013/506](http://eprint.iacr.org/2013/506)

[4] [http://eprint.iacr.org/2013/810](http://eprint.iacr.org/2013/810)</comment></comment></comment></comment>


Show HN: A Timer for Mob Programming - <AUTHOR> http://oss.jahed.io/agility/timer.html

<comment><USER2> You could have a "what is mob programming" link somewhere. The time picker says AM for me as well.</comment>


IT return file website (India)| Service Unavailable - <AUTHOR> https://incometaxindiaefiling.gov.in/e-Filing/UserLogin/LoginHome.html

Service Unavailable

This server is temporarily unable to service requests. Error code: 27 <comment><USER2> The site is back now.</comment>


Path just evolved with an entirely revamped product - <AUTHOR> http://techcrunch.com/2011/11/29/paths-second-iteration-is-less-photosharing-and-more-everything-sharing/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29

<comment><USER2> I've always felt that I'd love to use Path if any of my non-tech friends used it.

But I reaally don't feel like trying to explain to everyone I know why its different/better than just posting everything on facebook. And I'm normally the one convincing them to use the latest tech.

<comment><USER3> I'm a techie and I don't know why it's different/better than just posting everything on facebook.

<comment><USER4> I used the app for 5 minutes and I could write a thousand words on why it's better already. Honestly, if you can't see the differences, the quality compared to facebook, the difference in attitudes towards privacy, I don't think you can be helped.

</comment></comment></comment><comment><USER5> This can work. Just based on the 150 friend cap. You are in a way forced to choose your most active, friends. Those that you actually engage with via in person, email, Facebook messages, Skype etc., on a daily basis.

There was an article floating around somewhere on the concept of having an application with only 7 or so friends and how would a user deal with this restriction. Path is in the right direction for this. Also as opposed to Facebook, since a normal user does not have "Life Events" every day, I like the fact that Path has the awake/sleep feature (no matter how trivial it sounds).

</comment><comment><USER6> "In a novel feature for the life-sharing apps, the new Path will also automatically post your location ("Arrived") every time you travel a distance far enough to be reached by plane." Path is the first? Really?

</comment><comment><USER7> Another Social app? Even the most interesting, narcissistic person in the world doesn't have this much to share.

Is this what it's about? Narcissism? Are we all so vain?

<comment><USER4> I'm guessing you have no idea what Path is. It's for sharing with close friends or family. Family, in general, is interested in knowing what's up with other members. That isn't narcissism. This isn't facebook. Please stop with this whole narcissism crap when one, you don't understand the app, and two, you're on a website SHARING your opinion.

<comment><USER7> Fair enough. Let me try and understand this. Facebook is a social network for sharing with close friends or family. Path, on the other hand, is a social network for sharing with close friends or family.

Understood.

Addendum: I hope Path finds it's "path" to success. I sincerely do. I just don't think it has enough differentiation in the social media space.

</comment></comment></comment><comment><USER8> Personal metrics apps (i.e. Daytum) suck. I think Path is moving to fill this void. Auto-recording of location, sleeping habits & making it easy to record memories across networks are killer features. Not to mention that it looks great.

Tumblr took off because they took the content-creation out of blogging. Path works because it lets me keep a great journal without writing.

</comment><comment><USER9> Anyone here using Path a lot?

I wonder in a world with Facebook domination, if there is room for an app like Path. But if your FB stream gets flooded with low-quality posts and activity from tons of people, then people might want to gravitate toward something with higher quality posts from the people they care the most for. But not sure.

</comment><comment><USER10> Whatever about the merits of the product the Path team have made an incredibly beautiful user interface. Kudos to the team.

</comment><comment><USER11> yawn!

</comment><comment><USER12> what happened to TechCrunch's website? It's completely crashing on the iPad. It loads fine, then comes an avalanche of ads and stuff that slow it to a crawl until it quits.</comment>


Private messages from 81,000 hacked Facebook accounts for sale - <AUTHOR> http://www.bbc.co.uk/news/technology-46065796 <comment><USER2> Maybe it's time for the browsers to put more effort into extension network security.

1) Every extension has to declare up front what urls it needs to communicate to.

2) Every extension has to provide schema of any data it intends to send out of browser.

3) Browser locally logs all this comms.

4) Browser blocks anything which doesn't match strict key values & value values and doesn't leave browser in plain text.

<comment><USER3> Mozilla and Google should look at the top extensions and implement the popular ones as official extensions(or for some may be worth building them inside the browser), Reader mode is now part of some browsers so you do not need an extensions.

Mozilla could implement ad blocking extensions and give the user the option to use custom block list(so Mozilla is not accused of becoming a gate keeper).

<comment><USER4> Or maybe not: the Firefox version of the pocket extension is badly baked (you have to wait for the adding animation to disappear otherwise it gets cancelled. The previous version was "click and it's added in the background").

The Chrome version is more usable.

The great firefox redesign at the beginning of the century was about slimming down Mozilla the navigator and let extensions extend the browser. Is that the pendulum going back and forth ?

<comment><USER5> I think the minimum browser changes over time, but without adding and removing features it's hard to discover what that minimum is.

For example, some form of add or at least popup blocking should be included, but that does not preclude useful addons from customizing the experience.

</comment></comment></comment></comment><comment><USER6> Rogue extensions are the Achilles Heels of browsers, yet the ramifications aren't understood by the average user, who happily installs all sorts off addons and extensions. Frankly I'm surprised more sensitive information hasn't already been stolen/harvested all these years. This is why I run my browser with no extensions with the sole exception of uBlock Origin.

<comment><USER7> I wouldn't object to extensions becoming paid and verified - that is, an expert review team doing a code / security review for each update of an extension. Either paid for by the authors, or done for free by e.g. Google because they have plenty of money and they are directly impacted if their platform releases a malicious extension.

<comment><USER8> The downside to this would be that this would still be possible to bypass if users are allowed to install "unverified" extensions, but removing this feature would lead to the downsides of the App Store namely Google having full control over what their browser supports. Them being an advertising company, there are whole classes of popular extensions that directly hurt their business.

<comment><USER9> Unverified extensions are also a bitch now... I can't just install all my own via open-source extensions without a painful experience now in chrome.

It's a mixed bag.

</comment></comment></comment></comment><comment><USER10> Browser extension, although super useful freak me out.

Its the operating system equivalent of a kernel driver, getting access to everything.

They lack transparency, updates can be sketchy and I dont ever know based on what I should make trust decisions (number of downloads, is it an individual or company, permissions,.. )

</comment><comment><USER11> If I could purge some of my Facebook messages after a certain age, I think that would be great. When I downloaded my archive, I had circa-2006 messages with people who has since deactivated their accounts but their names were labeled "Facebook User."

<comment><USER12> This is a problem with almost any online 'space' \- everything sticks around forever. You can go left from anyone's Facebook profile picture and see probably the first picture they uploaded to Facebook. Snapchat's USP was that it didn't (not publically) keep stuff around.

I think there's a happy middle ground somewhere were I can set an expiration time on anything I post to such a platform (e.g. Facebook/Twitter) so that it goes private after that time - e.g. a year. It wouldn't even harm the bottom line, since all the money is in new content, and I'd still have a private archive of photos if I ever wanted to download them again.

All this is moot for me since I don't use services like this at all, but I think there's an opportunity for a company to get this right.

<comment><USER11> Definitely is an opportunity I hope that they pursue. Looking back at my first private messages on the platform like 10+ years ago is just full of cringe.

<comment><USER13> So is reading your own journal. And yet people write them.

Despite privacy issues, I still think that things sticking around "forever" on the Internet is a good default. Link rot is already a huge problem when you're trying to reference something you read in the past, and that's without auto- expiry.

<comment><USER14> But people don't tend to publish their life's journals to every random person who recognizes their name in a list of "would you like to friend request X?"

</comment></comment></comment></comment></comment><comment><USER15> Note that (according to the article) they claim to have 120mio accounts, the 81k are a sample posted online and verified by Digital Shadows.

<comment><USER16> For anyone else who read this before the coffee kicked in and thought "120mio" was the name of a startup or something:

Mio is an abbreviation for "millions" as a unit indicator in some financial markets, such as the German, Swiss, and Dutch markets. [https://en.wikipedia.org/wiki/Mio](https://en.wikipedia.org/wiki/Mio)

</comment></comment><comment><USER17> I think the headline is slightly misleading.

> [...] the data had probably been obtained through malicious browser > extensions.

It appears to actually be hacked browsers, or compromised browsers for that matter.

<comment><USER18> Perhaps, but only slightly imho. To your average HN denizen, 'hacked' implies the account was completely compromised. To the wider world it might well include partial compromise and/or the communications to/from the account even if the attackers didn't gain total control. Which is what this appears to be.

My parents, for example, would not understand the difference.

<comment><USER19> >My parents, for example, would not understand the difference.

Nor should they be expected to, but the BBC should know the difference. Facebooks stock price could be hurt due to this reporting, even though it shouldn't. This could be seen as an attempt at manipulating the stock price of a public trade company. Of cause it's just incompetence, but still.

<comment><USER20> The average tech reporter for a public service broadcaster most likely does not know the difference. How often do you read mainstream tech reporting and find yourself complimenting the journalist on their insight and factual correctness?

<comment><USER19> Well... pretty much all the time. That doesn't mean it's okay if they potentially hurt people and companies financially.

</comment></comment></comment></comment></comment><comment><USER21> Why aren't Facebook saying which extension caused this, and why aren't people being notified if their messages are leaked?

<comment><USER22> How does Facebook know what extensions were installed on the users browsers?

</comment></comment><comment><USER23> If someone makes money selling my messages - I want to know how!! I'll start selling them. Never thought this was a monetization possibility.

<comment><USER24> They are selling for $0.1 an account. I'll give you $0.1 for your messages.

<comment><USER25> > They are selling for $0.1 an account.

The important part is why it's 10 cents an account. Most of the accounts are worthless to them.

They are looking for the 1 in 10000 that is worth much more. Security, security, security...

</comment></comment></comment><comment><USER26> Is there a way to check who is affected? Have I been owned style

<comment><USER27> Hopefully Facebook has reported the issue to Chrome and they will remove the extension. Maybe at that point you'll get a notification about an extension being blacklisted by your browser.

<comment><USER28> What makes you think it was a single extension? If I were doing this I'd probably create many extensions (with various ostensible purposes packaged along with the spyware) to cast a wider net.

<comment><USER27> It probably wasn't a single extension, but the article proposes bookmarking and personal shopper extensions as likely culprits.

</comment></comment></comment></comment><comment><USER29> > And the data had probably been obtained through malicious browser > extensions.

Any reason we shouldn't suspect a malicious mobile app?

<comment><USER30> We should also consider the possibility that this is related to the Facebook breach discovered in September, in which attackers got access tokens to 50 million accounts.

[https://www.nytimes.com/2018/09/28/technology/facebook- hack-...](https://www.nytimes.com/2018/09/28/technology/facebook-hack-data- breach.html)

</comment></comment><comment><USER31> Anyone know if this also affects WhatsApp?

</comment><comment><USER32> In a GDPR violation who gets the fines? Is it users? the EC? the member state?

<comment><USER33> In this case there might not be a GDPR violation. If the data is taken by compromised browsers, then the breach wouldn't exist within Facebook's control.

It's not clear to me from reading the GDPR whether companies are responsible for the loss of personal data outside of breaches in their security. E.g. is a successful phishing campaign against customers a data breach? If not at fault, do they have an obligation to alert customers specifically about the attack?

</comment></comment><comment><USER34> > _Facebook said its security had not been compromised._

I mean, that's demonstrably untrue.

<comment><USER35> That's clearly true here. It was the security of users' browsers that was compromised.

</comment></comment><comment><USER36> If you've had enough of Facebook's negligence and like many others in recent months have closed your account, use this handy website to send them a GDPR request to make sure they delete all your personal data (disclosure, I'm one of the creators): [https://opt-out.eu/?company=facebook.com#nav](https://opt- out.eu/?company=facebook.com#nav)

<comment><USER37> I'm curious to see why you think this is Facebook's negligence. There's little they can do to control a user's browser extensions.

<comment><USER36> You have a point, although we don't know the details of this attack (they haven't even disclosed the name of the extension) so I guess I'm biased against them in light of recent history. My comment was more general than this particular incident.

</comment></comment></comment><comment><USER38> So I guess the data is now being shared across the border between security services and rightly so. The data and the story now have significantly more value to those services that bill the tax payer, and those that sell your attention using fear antagonising news media. So when an organisation demands you hand over your data, and it's for your security, it's not really, is it?</comment>


Show HN: A Lisp interpreter in C# 7 - <AUTHOR> https://github.com/nukata/lisp-in-cs <comment><USER2> Despite its humble size, this is a pretty sophisticated Lisp implementation. Not that one that can only do some additions, but also macros and stuff.

Kudos for doing the Lisp thing right.

UPDATE: Took one more look, this implementation is really impressive. It does stuff like 'defmacro', the whole code is just 1400 lines of C#. Never saw anything that effective in terms of functionality per line of code till this day. Impressive, very impressive. Also thanks for sharing.

<comment><AUTHOR> Thank you. This Lisp is a translation of my other Lisp in 1200 lines of Dart ([https://github.com/nukata/lisp-in-dart](https://github.com/nukata/lisp-in- dart)), which is, in turn, a digest or refinement of my old L2Lisp in Java ([https://github.com/nukata/l2lisp-in-java](https://github.com/nukata/l2lisp- in-java)). I did my best to optimize it for C# 7.

<comment><USER2> Good job Mr. Suzuki. You effort on C# 7 optimization shows, the result is clean and professional.

Regarding the speed of .NET implementation, it can be improved by leveraging LINQ expressions trees. In this way, one can achieve a good interpreter/JIT combo. The compiled code produced by LINQ expression trees is discardable. So you can temporarily cache it for frequent Lisp expressions (this gives JIT performance), and then discard rarely used parts of it (this gives a flexibility of an interpreter).

I'm myself in a Scheme camp of Lisp, but I love your implementation. This is the cleanest one I saw in years.

</comment></comment></comment><comment><USER3> Neat! One thing to mention, I would remove most of the benchmarks, and include only clisp, sbcl (I guarantee you this one is the fastest), clozure cl (ccl), and abcl.

<comment><AUTHOR> I wonder if it might be unfair to include the byte-compiled results (with _.fast and_.elc files) of CLISP and Emacs Lisp to the table.

</comment></comment><comment><USER4> Neat work! Also good demonstration of new C# 7.0 features.

<comment><AUTHOR> Thank you. I appreciated especially the pattern matching feature of C# 7 while programming the interpreter. For example:

            /// <summary>Evaluate a Lisp expression in an environment.</summary>
            public object Eval(object x, Cell env) {
                try {
                    for (;;) {
                        switch (x) {
                        case Arg xarg:
                            return xarg.GetValue(env);
                        case Sym xsym:
                            try {
                                return Globals[xsym];
                            } catch (KeyNotFoundException) {
                                throw new EvalException("void variable", x);
                            }
                        case Cell xcell:</comment></comment>


Ask HN: Why can't I get to HN from home? Am I banned? - <AUTHOR>

Recently I've noticed that I can't get to HN from my home IP (I'm using a proxy to post this).
This is a new problem for me, so I'm a bit unsure as to how to identify the root cause.
I can ping news.ycombinator.com, and I've attempted a traceroute, which seemed to get stuck on po1.car03.hstntx1.networklayer.com (184.108.40.206)  - The Planet.
Is there any way to tell if my IP/submet is banned somewhere? <comment><USER2> You didn't give much info, such as whether or not you really have a fixed IP address. I'm assuming you do.

The drop-dead on traceroute(1) seems normal, well, at least I'm getting the same. If I'm reading the domain name properly, it's hinting at Houston Texas as the last point where a border gateway/firewall responds.

Other than contacting PG directly and taking some of his time, there's really no way to find out if there's an IP/subnet ban in place.

If your ISP is doing something dumb (bad caching), then one possible answer is to use HTTPS rather than HTTP.

<https://news.ycombinator.com>

If someone using your ISP is doing something dumb (running a scraper), then you're probably stuffed.

<comment><AUTHOR> Thanks for the ideas…

I tried using SSL and got a 502 Proxy Error: "Error reading from remote server"

It seems to me (I could be totally off) that there may be a ban on HN which is refusing to give a response to requests from my IP.

If anyone can tell me I'm completely wrong, I'd really appreciate it.

Thanks again.

</comment></comment><comment><USER3> I had two separate failures recently -- they seemed to have been issues with parts of the route from at&t uverse. They both resolved themselves after 24-48 hours.</comment>


After 17 years, CSS gets variables. Finally.  - <AUTHOR> http://www.matthewhughes.co.uk/17-years-css-gets-variables-finally/

<comment><USER2> I was hoping for variables where the variable could update based on the screen dimensions or something like that. All this gives us is a shortcut to re-using the same styles.</comment>